- NANOG - lists.nanog.org

Trojan traffic from 115.100.250.112
by Hadas Shany 08 Mar '10

08 Mar '10

Hello NANOG, Yesterday we've found some strange requests in our logs, typical to the Daonol Trojan. According to the logs, the infected computers are sending personal information such as search engine lookups and browsing history. The information sent to 115.100.250.112. Log entry for example: GET http://115.100.250.112/x/?0ECiqocksamkpjqtnwhgrtieydpwgvnmktk2 HTTP/1.0..SS: More information on Daonol Trojan: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Nam… We've blocked all communication with this address. Thank you, Hadas Shany CERT.GOV ISRAEL

1 0

Sponsoring request Piratenpartij Nederland
by Sven Olaf Kamphuis 07 Mar '10

07 Mar '10

Pardon the interruption regarding this somewhat unusual request, but please forward this to your sponsoring/donations/legal/lobbying department: ---------------------------------------------------------------------- Dear Internet Industry representatives: The Pirate Party Netherlands ( Piratenpartij Nederland), which is concerned with online and offline civil rights and a revision (reduction) of copyright law, is planning to take part in the upcoming parliamentary elections in the Netherlands. Although participation in the elections is open to all parties, it is not without costs. Therefore, the Pirate Party needs external funding from both individuals and organisations which share our vision. The costs which we incur are the following: - EUR 11250.- deposit to the election council (www.kiesraad.nl) to be recieved back if the party attains 75% of one parliamentary seat. - EUR 450.- registration fee for political parties at election council (www.kiesraad.nl) - EUR 500.- notary costs - EUR 150.- chamber of commerce registration (formal association with legal personality) - Online and offline advertising and campaign costs That is why we ask organisations and individuals for contributions to Pirate Party Netherlands. More information can be found at: http://staging.piratenpartij.nl/ Kind regards, representing Pirate Party Netherlands Rogier Huurman, Secretary Pirate Party Netherlands Sven Olaf Kamphuis, Member Piratenpartei Deutschland Member Piratenpartij Nederland Contact: Samir Allioui, Co-President at Pirate Parties International Chairman Piratenpartij Nederland +31627588738 samir.alioui(a)piratenpartij.nl ---------------------------------------------------------------------- Geachte vertegenwoordigers van de Internet Industrie, De Piratenpartij Nederland, die zich inzet voor online en offline burgerrechten alsmede een herziening (beperking) van de auteursrechten, is voornemens deel te nemen aan de komende verkiezingen voor de Tweede Kamer der Staten Generaal. Deelname aan de verkiezingen is dan wel vrij voor iedereen, maar het is zeker niet gratis. De Piratenpartij heeft daarom behoefte aan externe financiC+le injecties van zowel particulieren als organisaties die zich door onze standpunten aangesproken voelen. De kosten die wij moeten maken zijn als volgt: - 11250 euro borgstelling voor de kiesraad (www.kiesraad.nl) terug te ontvangen van de kiesraad door de partij bij het halen van 0.75e deel van 1 zetel - 450 euro eenmalige inschrijvingskosten kieslijst (www.kiesraad.nl) - 500 euro notariskosten - 150 euro kamer van koophandel (formele vereniging met rechtspersoon) - Online en offline advertentie- en campagnekosten Wij vragen daarom organisaties en particulieren om bijdragen ten bate van de Piratenpartij Nederland. Verdere informatie is beschikbaar op http://staging.piratenpartij.nl/ Met vriendelijke groet, namens Piratenpartij Nederland, Rogier Huurman, Secretary Pirate Party Netherlands Sven Olaf Kamphuis, Lid Piratenpartei Deutschland Lid Piratenpartei Nederland Contact: Samir Allioui, Co-President at Pirate Parties International Voorzitter Piratenpartij Nederland +31627588738 samir.alioui(a)piratenpartij.nl ---------------------------------------------------------------------- PiratenPartij Nederland Postbus 58006 NL-1040 HA Amsterdam The Netherlands

1 0

Re: SDSL vs T1 (was Locations with no good Internet)
by msokolov＠ivan.Harhan.ORG 07 Mar '10

07 Mar '10

Roy <r.engehausen(a)gmail.com> wrote: > You missed an option. Just change to another ISP. I know of at least > one AS701 address block still attached to a company that hasn't been > their customer for ten years or so. How is that possible? AFAIK no local politician has passed an IP address portability law yet. If my circuit from VZB were disconnected, wouldn't they release the address block for reuse by other customers just like any other ISP? I'm kinda guessing that you're suggesting that VZB's business practices are lax and that I may slip through the cracks? But there is no guarantee of any kind, is there? If they were to release/reuse my address block like they would have every right to, what recourse could I possibly have as a voluntarily disconnected customer? And even if the block remained unused / not reassigned after I left VZB, how could I possibly get it routed to me while connected through another ISP? I just don't get it - I don't see how this could be done without some local politician passing an IP address portability law like has been discussed recently. MS

2 1

Re: Alcatel-Lucent
by Scott Weeks 07 Mar '10

07 Mar '10

--- jrhett(a)netconsonance.com wrote: So my experience so far has been good product, good company, needs a real attitude adjustment in the support department. ----------------------------------------- ditto that! scott

1 0

SDSL vs T1 (was Locations with no good Internet)
by msokolov＠ivan.Harhan.ORG 06 Mar '10

06 Mar '10

Patrick Giagnocavo <patrick(a)zill.net> wrote: > Isn't this really an issue (political) with tariffed T1 prices rather > than a technical problem? Yes, of course. It's even worse if you are tied to one particular ISP (VZB) by non-portable IP addresses. I wanted service from AS701 with a V.35 hand-off; both requirements (the ISP choice and the hand-off type) were/are for sentimental reasons. Speed was/is a lower-priority concern, i.e., I was/am willing to live with sub-T1 speeds if it allows me to keep my 701-assigned IP addresses for a lower monthly extortion payment. My choices were: 1. Get a T1, enjoy the bandwidth (I live in an alternate Universe in which T1 bandwidth is almost infinity) and the SLA, and getting a V.35 hand-off would have been as easy as pulling an Adtran DSU out of my junk pile. But it was something like $650/month, probably before adding taxes and other extortions. 2. Opt for SDSL instead. I'm within a short walk of my CO, but I opt for only 384 kbps to reduce the monthly extortion payment. And since I still want V.35 hand-off, add the expense of designing and building my own CPE for it - but it's a one-time expense, and I have learned a *lot* in the process - as they say, happiness is a journey, not a destination. > I was told that most T1s are provisioned over a DSLAM these days > anyways, and that the key difference between T1 and DSL was the SLA > (99.99% guarantee vs. "when we get it fixed"). My situation is different because I am deliberately opting for a lower- speed service than what's available. At sub-T1 speeds SDSL has one advantage: the actual electrical signaling rate on the circuit is lowered to match the subscription data rate, unlike the fractional T1 kludge. But if you are specifically looking for a 1.5 Mbps service and are prepared to pay for 1.5 Mbps, the T1 vs. SDSL trade-off starts to look murkier: * With a T1 regardless of who serves it to you and how, you still get the classic HDLC encapsulation supported by every decent WAN router; with SDSL served out of a Covad DSLAM you get ATM cells on the line, wrapped in a wacky frame format: http://ifctfvax.Harhan.ORG/OpenWAN/2B1Q/flavors/nokia.html * Prior to my invention of the OSDCU gadget, it was not possible to connect a Covad SDSL line to a real router like Cisco (or Juniper or a BSD/Linux box or whatever), only to some very inferior router brands supplied as the "standard CPE". And as far as my gadget goes, I've built the hardware, but I haven't finished the firmware part yet, so it's still technically vaporware. * ATM is much less bit-efficient than HDLC, so a Covad SDSL circuit sold as "1.5 Mbps" actually has a little less real data carrying capacity than a T1. * I don't know off the top of my head what the monthly price is for Covad SDSL at 1.5 Mbps, and there probably is some variability between different ISPs who go through Covad, but I assume that even with a good deal it would still be a bit more than what I pay to VZB for 384 kbps. T1 prices have been coming down OTOH, at least for those who aren't tied to VZB. But I still expect T1 to be at least a little more expensive than SDSL @ 1.5 Mbps. I don't know how big this price delta is right now though - would anyone here have a better idea? The magnitude of this price delta ought to have a critical impact on whether or not it is worth putting up with all the quirks of SDSL listed above. For my peculiar situation (willing to live with 384 kbps and tied to VZB) the price delta (>3x increase in the monthly payment) is most definitely worth the one-time expense of finishing my OSDCU gadget, but I don't know how the cards would fall for someone who is looking for full 1.5 Mbps (or more with bonding) and who has a choice of ISPs. > And T3/DS3 can run over what, 4 copper pairs? Yet how much is the > typical tariffed rate for that? DS3 over 4 copper pairs? ~11 Mbps symmetric on each pair? That seems like squeezing a lot out of a copper pair to me. Over what distance? William Herrin <bill(a)herrin.us> wrote: > The major difference between using HDSL smart jacks and classic smart > jacks is that the HDSL ones don't need wire that's in quite as good > shape and they don't need repeaters between you and the CO as often. > They're still very much a T1 service. Yup. Even though at the transceiver chipset level HDSL and SDSL are very much alike, the powers that be configure them very very differently at the higher layers. HDSL units are configured to pass the entire T1 frame structure (SF/ESF) unaltered, and within that T1 frame structure you get the good old familiar HDLC. Covad SDSL uses the same 2B1Q line code as HDSL and even the same transceiver chip (Bt8970 or RS8973), but stuffs the bit stream with ATM cells in a wacky non-standard frame structure instead of HDLC or T1 frames. One can either pay a monthly premium for a more standards-based bit stream format, or pay less per month for the hoary non-standard Nokia flavor and make a one-time expense of building a converter gadget to transform it into HDLC (per FRF.8 or FUNI) as soon as it enters your premises. MS

2 1

Comcast cust cannot reach Chris Boyd's IP x.x.x.x (was Problem from Comcast Network to The Planet)
by Routing Bits 06 Mar '10

06 Mar '10

> > Message: 7 > Date: Fri, 5 Mar 2010 17:40:45 -0600 > From: Chris Boyd <cboyd(a)gizmopartners.com> > Subject: Re: Problem from Comcast Network to The Planet > To: nanog(a)nanog.org > Message-ID: <5DF52A7E-7288-433B-8B08-EA9530B29400(a)gizmopartners.com> > Content-Type: text/plain; charset=us-ascii > > > > I don't know what's going on in the Comcast network, but I've been having > similar fits with a single IP address in my network. Comcast can get to > nearby IP addresses in the same /24 no issue. The Comcast customer in my > case is in Florida, and I get to them via TWTelecom. > > I know it's not my net, and TWT was very helpful and knows it's not their > net. > > Attempts to get Comcast to look into it seem to end with them pinging their > customer's IP address from the Comcast support center and terminating the > call "since they can reach them." > --Chris Chris, Maybe Comcast abuse is blackholing the host? What is the host IP? Is it more than one Comcast customer unable to reach that host? What is the IP of the Comcast customer(s) unable to reach it? What do traces from the host to the customer and from customer to host look like?

1 0

Re: Locations with no good Internet (was ISP in Johannesburg)
by msokolov＠ivan.Harhan.ORG 06 Mar '10

06 Mar '10

Charles N Wyble <charles(a)knownelement.com> wrote: > The biggest problem is middle mile. That is where the money needs to go. > You need something to back haul to the interwebz. There is a lot of > fiber in the ground already, Another possible way to solve the middle mile issue would again be to use the copper plant that's already in the ground. Unlike fiber, the copper plant is *ubiquitous*: I don't know of any place in the 1st or 2nd worlds that doesn't have copper pairs going to it. Also AFAIK T1s are available everywhere too: if you order a T1, they'll deliver it to you regardless of how deep you are in the middle of nowhere, although I suppose there likely are extra surcharges involved. Granted, a T1 at 1.5 Mbps may not be much for backhaul, but what about bonded T1s? Bond 4 of them to get 6 Mbps symmetric - not too bad in my book for a rural community. And again using SDSL instead of T1 offers a cost reduction opportunity. One could get that 6 Mbps symmetric for much cheaper by bonding 4 SDSL circuits running at 1.5 Mbps each instead of T1s. There is a Covad DSLAM with SDSL capability in virtually every CO in the country, but they serve out a whacky flavor of SDSL/2B1Q. I have good reason to suspect that I may be the last person alive on Earth who knows how to make CPE for this flavor *and* who cares about such things. > but there are numerous layer 8 issues with > getting to it most of the time. Solving those is an exercise left for > the reader. Layer 8? Assuming that layers 8, 9 and 10 are management, financial and political, respectively, the issues that keep me from being able to build that Covad-compatible bonded NxSDSL CPE device lie at Layer 9. Anyone interested in helping me solve those issues? MS

2 1

Problem from Comcast Network to The Planet
by Zachary Frederick 06 Mar '10

06 Mar '10

We have been having a problem emailing to a customer whose server is hosted by The Planet (http://www.theplanet.com/) Our mail server is hosted in-house on a comcast business connection. IP address of our server is: 173.13.45.23 Customers mail server is: 69.93.203.243 I cannot telnet to port 25 on their server, and they cannot telnet to port 25 on ours. If I try to connect to their mail server from a different network such as my home internet connection, I can connect. We do not do any firewalling that would block this in anyway. We were able to send and receive email to them when we used Qwest for our connection, before we switched to Comcast. Comcast has said the problem is not on their end because it times out at The Planet. The Planet doesn't have much interest in speaking with me, because I'm not their customer. Not sure what to do at this point. Below is a traceroute: traceroute to 69.93.203.243 (69.93.203.243), 64 hops max, 52 byte packets 1 223.254.254.75 (223.254.254.75) 2.610 ms 2.057 ms 2.033 ms 2 173-13-45-30-pennsylvania.hfc.comcastbusiness.net (173.13.45.30) 3.656 ms 2.997 ms 3.119 ms 3 * * * 4 68.85.72.129 (68.85.72.129) 10.497 ms 9.624 ms 12.245 ms 5 te-9-1-ur02.greensburg.pa.pitt.comcast.net (68.86.100.53) 9.935 ms 10.049 ms 10.505 ms 6 te-3-2-ar01.mckeesport.pa.pitt.comcast.net (68.86.100.49) 14.795 ms 12.846 ms 14.006 ms 7 te-0-4-0-5-cr01.mclean.va.ibone.comcast.net (68.86.91.129) 17.868 ms 16.278 ms 21.110 ms 8 pos-1-10-0-0-cr01.atlanta.ga.ibone.comcast.net (68.86.86.126) 43.022 ms 40.690 ms 39.818 ms 9 pos-1-15-0-0-cr01.dallas.tx.ibone.comcast.net (68.86.85.149) 58.980 ms 58.914 ms 59.673 ms 10 pos-0-0-0-0-pe01.1950stemmons.tx.ibone.comcast.net (68.86.86.90) 59.608 ms 60.322 ms 59.691 ms 11 theplanet-cr01.dallas.tx.ibone.comcast.net (75.149.228.2) 62.246 ms 61.320 ms 61.693 ms 12 te3-5.dsr01.dllstx3.theplanet.com (70.87.253.86) 61.431 ms te7-1.dsr02.dllstx3.theplanet.com (70.87.253.18) 58.859 ms 59.365 ms 13 76.fd.5746.static.theplanet.com (70.87.253.118) 62.690 ms te1-3.dsr02.dllstx2.theplanet.com (70.87.253.122) 68.123 ms te3-3.dsr02.dllstx2.theplanet.com (70.87.253.126) 59.382 ms 14 po1.car02.dllstx2.theplanet.com (70.87.254.82) 59.321 ms 60.268 ms 66.206 ms 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * 31 * * * 32 * * * 33 * * * 34 * * * 35 * *^C

6 5

Bell canada CIDR
by Greg Whynott 05 Mar '10

05 Mar '10

Hello, We received a /21 from ARIN a year or so ago which we have been using. At the time I noticed Bell was advertising a longer CIDR which included ours. I contacted Bell, they said it would be corrected, multiple times. Who I might contact to have this resolved? Thanks for your time, greg AS11628 ipcalc 206.108.120.0/21 => Network: 206.108.120.0/21 HostMin: 206.108.120.1 HostMax: 206.108.127.254 AS577 ipcalc 206.108.96.0/19 => Network: 206.108.96.0/19 HostMin: 206.108.96.1 HostMax: 206.108.127.254

3 2

Re: IP4 Space - the lie
by Suzanne Woolf 05 Mar '10

05 Mar '10

On Fri, Mar 05, 2010 at 12:39:19PM +0000, bmanning(a)vacation.karoshi.com wrote: > er... what part of dual-stack didn't you understand? > dual-stack consumes exactly the same number of v4 and v6 addresses. > > if you expect to dual-stack everything - you need to look again. > either you are going to need: > > lots more IPv4 space > > stealing ports to mux addresses > > run straight-up native IPv6 - no IPv4 (unless you need to talk to > a v4-only host - then use IVI or similar..) > > imho - the path through the woods is an IVI-like solution. There are several IPv4/IPv6 co-existence technologies under development that attempt to resolve the asymmetry Bill notes here, where IPv4 addresses are already scarce and IPv6 addresses may reasonably be treated as less so. They include IVI, NAT64/DNS64, and dual-stack lite. See for example the lightning talk last Wednesday in Austin on AFTR, ISC's free, open source implementation of dual-stack lite, or the panel discussion at APRICOT earlier this week. It's only been in the last couple of years that the IETF and the vendors have been taking seriously the problem of moving IPv4-IPv6 co-existence mechanisms into the network, away from host-based dual-stack and into use cases where legacy infrastructure has to co-exist with the need for growth. But now that they have, there's an embarrassment of what we can hope turn out to be riches in this area....or at least a pony amongst the, err, bulk of material. Suzanne

4 3